CVE-2026-105118 OpenIdentityPlatform CVE debrief

Who should care

Defenders responsible for OpenAM deployments should assess exposure and prioritize verification and remediation to prevent exploitation. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Defenders should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

Defenders should care about CVE-2026-105118 because it allows unauthenticated attackers to redirect users, potentially leading to phishing attacks, and requires verification and remediation to prevent exploitation.

• Potential phishing attacks using the open redirect vulnerability
• Need to verify and upgrade to OpenAM version 16.1.3 or later
• Possible impact on users who click on malicious links

Technical summary

The open redirect vulnerability in OpenAM before 16.1.3 allows unauthenticated attackers to redirect users by supplying an unverified id_token_hint to the /oauth2/connect/endSession endpoint. This enables phishing attacks that borrow the OpenAM host's trust. Defenders should prioritize verifying and upgrading to OpenAM version 16.1.3 or later to prevent potential phishing attacks. The vulnerability allows attackers to name any realm client in a forged hint to redirect victims to any registered post-logout URI, enabling phishing attacks.

Defensive priority

Defenders should prioritize verifying and upgrading to OpenAM version 16.1.3 or later to prevent potential phishing attacks.

Recommended defensive actions

• Verify OpenAM version and upgrade to 16.1.3 or later
• Monitor for potential phishing attacks
• Implement additional security measures to prevent open redirect attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide information on the open redirect vulnerability in OpenAM before 16.1.3. The vulnerability allows unauthenticated attackers to redirect users, potentially leading to phishing attacks. Defenders should verify OpenAM deployments and upgrade to version 16.1.3 or later to prevent exploitation. The CVE record was published on 2026-10-03T14:16:38.563Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.